feat(backend): sprint 4 — tactic_ids + done guard + engagement auto-status

- Simulation model: add tactic_ids JSON column (nullable=False, default=[])
- Migration 0004: ADD COLUMN tactic_ids (server_default='[]', no batch needed)
- mitre.py: add _TACTIC_IDS map, lookup_tactic(), get_tactic_name()
- simulation_workflow.py: done guard (409) before RBAC; SOC gate += tactic_ids;
  _resolve_tactic_ids() validates against hardcoded map; auto-transition += tactic_ids;
  transition done→review_required is Reopen (all 3 roles); _maybe_activate_engagement hook
- serializers.py: _enrich_tactics() → serialize_simulation adds tactics:[{id,name}]
- test_simulations_tactics.py: valid/invalid/dedup/SOC gate/auto-transition/no-bundle
- test_simulations_done_readonly.py: 409 all roles, Reopen all roles, invalid transitions, after-reopen ok
- test_engagement_lifecycle.py: planned→active on auto-transition, already active/closed unchanged, migration 0004 round-trip
- Updated test_simulations_patch.py + test_simulations_workflow.py for AC-18 behavior

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_simulations_patch.py

@@ -230,9 +230,10 @@ def test_soc_can_patch_when_review_required(
     assert body["incident_number"] == "INC-001"
 
 
-def test_soc_can_patch_when_done(
+def test_patch_when_done_returns_409(
     client: FlaskClient, redteam_token: str, soc_token: str
 ) -> None:
+    """Done is terminal — PATCH is rejected for ALL roles (AC-18.1)."""
     eng = _make_engagement(client, redteam_token)
     sim = _make_sim(client, redteam_token, eng["id"])
     client.post(
@@ -247,7 +248,8 @@ def test_soc_can_patch_when_done(
     )
 
     resp = _patch(client, soc_token, sim["id"], {"soc_comment": "Final note"})
-    assert resp.status_code == 200
+    assert resp.status_code == 409
+    assert resp.get_json()["error"] == "simulation is done — reopen first"
 
 
 def test_soc_cannot_edit_redteam_fields(